In-Depth Analysis of OCTAVE Allegro Risk Framework for UAB Students

This report provides a comprehensive analysis of the OCTAVE Allegro risk framework, beginning with an introduction to the framework, its history, and its relation to OCTAVE. It discusses the evolution of the OCTAVE method, highlighting experiences using it, the need for OCTAVE Allegro, and its requirements. The roadmap of OCTAVE Allegro is detailed, followed by guidance on using the framework, including preparing for it and performing assessments. The report also outlines the benefits of risk assessment with OCTAVE Allegro and explores future works, such as evolving the technique by focusing on organizational processes and services, expanding the view beyond the operational unit, and applying OCTAVE Allegro in the SDLC. Finally, it looks forward to expanding the interest community, exploring connections in the CERT Resiliency Framework, and updating and improving training related to the framework.

Running head: RISK FRAMEWORK
Risk Framework
Name of Student-
Name of University-
Author’s Note-

1RISK FRAMEWORK
Table of Contents
1. Introduction..................................................................................................................................3
1.1 OCTAVE Risk Framework...................................................................................................3
1.2 History of OCTAVE Framework..........................................................................................4
1.3 Introduction to OCTAVE ALLEGRO...................................................................................4
2. Evolving the OCTAVE Method..................................................................................................5
2.1 Experience Using OCTAVE Method....................................................................................5
2.2 Need of OCTAVE Allegro Method.......................................................................................5
2.3 Requirements for using OCTAVE Allegro...........................................................................6
3. Roadmap of OCTAVE Allegro...................................................................................................6
4. Using the OCTAVE Allegro Risk Framework..........................................................................10
4.1 Preparing the Octave Allegro..............................................................................................10
4.1.1 Obtain Sponsorship of the Senior Management...........................................................10
4.1.2 To Allocate Organizational Resources.........................................................................11
4.1.3 Requirements for Training............................................................................................11
4.2 Performing the Assessment.................................................................................................11
4.2.1 To Select Information Assets........................................................................................12
4.2.2 To Develop the Criteria of the Risk Measurement.......................................................12
4.2.3 To Repeat the Assessment............................................................................................12
5. Benefits of Risk Assessment with OCTAVE Allegro...............................................................13
6. Future Works and Conclusion...................................................................................................13
5.1 Evolving the Technique of Octave Allegro.........................................................................14
5.1.1 To Focus on the Organizational Processes and the Services........................................14
5.1.2 Expanding View beyond the Operational Unit.............................................................14
5.1.3 Applying the OCTAVE Allegro in SDLC....................................................................15
5.2 Looking Forward in Future..................................................................................................15
5.2.1 Expanding Interest Community....................................................................................15
5.2.2 Exploring Connections in CERT Resiliency Framework.............................................16
5.2.3 Updating as well Improving Training...........................................................................16
References......................................................................................................................................17

2RISK FRAMEWORK
1. Introduction
Management of risk and mitigation of risk is basically a process that is used to identify,
access as well as mitigate the scope of the risks, the schedule, quality, and the cost of the risk in a
project. There are many opportunities as well as threats from where the risk comes from and the
risks are scored on their occurrence probability as well as impact of the project (Wangen,
Christoffer and Einar). The planning that is done for mitigating the risk is basically a process that
develops the options as well as actions for enhancing the opportunities as well as reducing the
threats related to project objectives. Implementation of the risk mitigation is considered as a
process that executes the action to be taken for risk mitigation. The monitoring of risk mitigation
involves the risks tracked are identified, along with identifying many new risks as well as
evaluating the effectiveness of risk process all through the project.
For having a better management of risk as well as mitigation roadmaps, many of the
organizations have very high information security frameworks that would help to seize the
opportunities as well as achieve the strategic goals of the organization (Kawanishi et al.). One
framework that can be involved for getting high information security is Operationally Critical
Threat, Asset and Vulnerability Evaluation (OCTAVE). This approach is mainly built by the SEI
(Software Engineering Institute) for addressing all compliance challenges of information security
that are faced by the organizations.
The methodologies involved in OCTAVE are mainly created for tackling the challenges
of information security that are faced by (DoD) Department of Defense in U.S. The
methodologies of OCTAVE have various number of effectiveness and presently this particular
methodology is used by the public as well. The objective of the OCTAVE approach is helping
the organizations for ensuring the goals as well as objectives that are connected with activities of
information security.
1.1 OCTAVE Risk Framework
The methodology of risk assessment of OCTAVE approach is identifying the security
risks, managing them, as well as evaluating the information of the security risks. The OCTAVE
methodology mainly serves an organization in the following ways:
 Helps in developing the criteria of risk evaluation that helps in describing the operational
risk tolerance of the organization.
 Helps in identifying all assets needed for accomplishing the mission of the organization.
 Identifying the vulnerabilities as well as threats for all the assets.
 Determining as well as evaluating the consequences that are faced by the organizations if
there is threat in the organization.
 Initiating the continuous improvement of the actions for mitigating the risks.
The methodology of OCTAVE approach helps in directing the individuals responsible for
management of the operational risk of the organization (Wahlgren and Stewart 129-151). This
might include the business personnel of the organization of the business units, the person that are
involved in the information security or the conformity in the organization, the risk managers, and
the department of information technology as well as participation of the staff in activities of the
risk assessment with helps of the OCTAVE approach.
1.2 History of OCTAVE Framework

3RISK FRAMEWORK
For resolving the continuous issues related to the risk management, the SEI has
developed the first ever OCTAVE approach framework in the year 1999. This particular
framework included large corporations having 300 employees or more. The framework was then
having hierarchy of multi-layer as well as the framework is also responsible for managing the
software infrastructure in the organization (Ilvonen and Jari 270-281). The main evaluation
criteria that helps to use the framework are mainly based on an approach that is three phased.
The three phase approach includes technological view, Risk Analysis, and Organizational View.
In the year 2003, updating the original framework was developed and was then named as
the OCTAVE-S risk assessment framework. This particular approach was developed for the
small organizations having less than 100 employees having hierarchy that is flexible and can also
have team members that are specialized (Pan and Tomlinson 270-281). The approach containing
three phase is basically used in the approach of OCTAVE and is intended for the small teams in
the organization that can deal this approach.
Finally in the year 2007, the CERT team (Computer Emergency Response Team) is a
particular program conducted by SEI has updated the version of OCTAVE-S and named it as
OCTAVE Allegro. This approach is developed for the organizations that mainly focuses on the
information assets of how the framework will be used by the organization and how the
information is stored, processed as well as transported in the organization (Aries). The
organization also focuses on how their information assets are exposed to the threats, disruptions,
and vulnerabilities. The allegro version of the OCTAVE framework helps in reducing many
requirements as well as processes that helps in making the framework easy to use. The Allegro
approach helps in shifting the OCTAVE approach from asset centric technology to a risk
assessment that is based on the information.
1.3 Introduction to OCTAVE ALLEGRO
OCTAVE Allegro is basically considered as a methodology for restructuring as well as
optimizing the process of measurement included in the security risk for achieving the required
goal having small investment in the specified time, specified people, and include other resource
as well (Suroso and Rahadi). With the help of OCTAVE Allegro methodology, the organizations
helps in considering the people, facilities as well as technology in regards with the information,
services as well as business processes that are supported by the framework.
The OCTAVE Allegro mainly defines all critical components included in a framework of
risk assessment of the information security. This is mainly done by referring the risk with
availability, integrity as well as confidentiality of the assets. With this approach, the organization
will not have any problem to define the critical assets which can occur risk or the risk that are not
mentioned in the methodologies of the organizations (Wangen). The OCTAVE Allegro mainly
provides clear instruction about the way of identifying the critical assets in same time connected
with the organizational goals as well as objectives related to security goals as well as objectives.
The security teams included framework will mainly work together with operational teams for
addressing the needs of information security for protecting the critical data. The IT departments
of the organization will not take the critical decisions.
The organizations that includes the OCTAVE Allegro approach mainly requires the
profiles of information assets for having better as well as unambiguous definition for the asset
boundaries (Whitman). The profile helps to enable the organization in defining the security

4RISK FRAMEWORK
requirements, assigning the ownership as well as set the values. After the profiles being created,
the organizations can update as well as change the future assessments with respect to the need of
the organization.
2. Evolving the OCTAVE Method
2.1 Experience Using OCTAVE Method
There is wide range of the type of market, size of the market as well as business of the
market involved in the organization that are using the framework of the OCTAVE method. The
organizations have thus found many success for applying, institutionalizing as well as tailoring
the method either of the streamlined form or in the allegro form. These methods helps the
organization to have a risk assessment in their working process, their culture as well as
organizational structure (Meszaros and Buchalcevova 300-313). The main ability for connecting
the organizational goals as well as objectives for gaining goals of information security and
achieving the objective of the organization. The organizations can apply the approach of
OCTAVE framework mostly bring in operational as well as organizational view point
information for the activities of the risk management. This allows them to evolve the
vulnerability management as well as reactive the activities that comes toward the risk
management of information.
The main aspect of the OCTAVE method is mainly providing a perspective that is
interdisciplinary to risk identification, mitigation processes as well as risk assessment. The
workshop that is based on the data collection as well as analysis process of all the methods that
exits in OCTAVE method (Aminzade 9-11). This helps in bringing together all the disparate
groups in organization that comes for a common purpose. For this collaboration, all
organizations always exposes the issues that limits the ability for identifying as well as
mitigating the risks that includes:
 The gaps that occurs in the communication channels of the organization
 Different levels of understanding as well as communication of the policies that are
involved in the levels of organization.
 Gaps that are included in the practice as well as in the intended effects.
This aspect of the OCTAVE method also provides diversity understanding, opinions, as
well as experience that helps in strengthening the breadth and the quality of activities of risk
mitigation as well as risk assessment.
2.2 Need of OCTAVE Allegro Method
There are many organizations that deploys as well as institutionalize the OCTAVE
approach and the OCTAVE-S approach. But, these methods have become old by the year 2004
(Tøndel et al. 1-30). The risks from information security that are to be managed by the
organization as well as the capabilities of the organization helps in managing the changing risk
after introduction of the methods in the organization. There are many significant bodies of
knowledge that are acquired by applying as well as teaching the OCTAVE as well as observing
other companies using this method for improving its processes.
One of the main reason for the user centric risk assessment is to gain more centric
information of risk assessment. Organization mainly focus on the security assessment of the

5RISK FRAMEWORK
organization and all the other assets are easily bought in the process as the containers where all
information assets gets transported, processed or stored (Hariyanti, Arif and Daniel Oranova).
Example of container can be a person, a technology or an object. The threats included in the
information asset are mainly examined by the considering their place to live which limits the
total number as well as types of assets that are bought in the process. Emphasizing more focus on
the information asset limits the total amount of information that are actually gathered,
understood, and analyzed before performing a risk assessment.
With the given size of the method along with the complexity of method, it is clearly
understandable that the organizations face challenges for embracing the approach of OCTAVE
and using the approach of OCTAVE. Absorbing numerous number of pages containing the
process documentation, worksheet understanding and about how to use them, as well as the way
to collect and organize the data that are needed are mostly challenging task for the organizations.
There can be a sheer data collection volume for implementing the methods in the organization
and some of them also move forward with the task performing for analyzing as well as
mitigating the tasks.
Reflecting the knowledge as well as the insights that are acquired when the first
OCTAVE approach was implemented mainly indicates that with the updated approach to
perform security risk assessment is very important phase. This helps in forming the basis of
establishment while setting the requirements that is evolved from the OCTAVE approach. This
helps to meet the organization needs that are changing and are also capable of handling
operational risks that are more complex.
2.3 Requirements for using OCTAVE Allegro
The requirement that are needed for using the OCTAVE allegro approach does not only
describe what is to be built or the reason for it building up (Amini and Norziana). The
requirements provides way to measure whether particular activity is successful or not. First step
that is included to develop an OCTAVE approach in an updated version is capturing a design set
of requirements that is derived from the field use, the classroom experience, and the observation.
The requirements are listed below:
 Improving easy usage.
 Refining definition of scope of the assessment.
 Reduce the training as well as getting knowledge of requirements
 Reduce the resource commitments
 Encouraging repeatability as well as institutionalization
 Produce comparable as well as consistent result in the enterprise
 Facilitate the development of the risk assessment for competency
 Support the requirements of enterprise compliance
3. Roadmap of OCTAVE Allegro
The approach of OCTAVE Allegro is explained in this section and is designed in a way
that allows broad assessment that control the risk environment of the organization with goal that
produces result that is more robust without involving extensive knowledge of risk assessment.
This OCTAVE Allegro approach mainly differs from other approaches of OCTAVE that helps in
focusing all the information assets that are primarily needed (Kozlovs, Kristine and Marite). The

6RISK FRAMEWORK
information assets includes their usage, the way to store them, the place where they are stored, or
transported or is processed. The information asset also states about the threats, disruptions as
well as vulnerabilities that comes as a result. Same as the other previous methods, all OCTAVE
Allegro is to be performed in the workshop style and in collaborative setting. The OCTAVE
Allegro method is supported with proper guidance, questionnaires, as well as worksheets. This
particular method is also suited for the individuals who requires to perform the assessment of
risk without involvement of the extensive organization or expertise.
The approach of OCTAVE Allegro includes eight steps which are actually organized in
four phases that is shown in the figure 1 below. The diagram show four phase; phase 1 includes
the organizational development criteria of risk measurement that is consistent with the
organization drivers. In the phase 2, the information asset are actually determines to be a critical
one are profiled. This process of profiling mainly establishes boundaries that has clear asset,
identifies the security requirements, as well as identifies all other locations that stores the asset,
transports them as well as process them (Wangen et al.). In the 3rd phase, the threats included in
the information assets are mainly identified in their location context about the storing of asset,
transportation as well as processing of the asset. In the 4th phase, the risk faced by the
information asset are mainly to be identified as well as analyzed and their development for the
mitigation approaches are discussed.
For making the process of OCTAVE Allegro more easy to use, this particular approach
has reduced many requirements as well as complications that were present in the previous
OCTAVE and OCTAVE-S approach of risk assessment. The eight steps are show below divided
into four categories namely identify phase, analyze phase, assess phase, and mitigation of the
potential risks included. Relationship in the activity area as well as in actual methodology step
are shown below: All the phases of the OCTAVE Allegro approach are explained in the section
below along with the steps that are included in the phase.
Figure 1: Steps of OCTAVE Allegro
(Source: Kelo, Eronen, and Rousku 50)

7RISK FRAMEWORK
I. Establish Drivers – This phase of the OCTAVE Allegro only contains the few steps
that are to be taken by the organization that helps in developing the criteria of risk measurement
which are consistent with the drivers of the organization. These particular drivers can be used for
evaluating effects of risks for completing a mission of an organization and the concerned
objectives. The establish drivers includes all the criteria of risk measurement that an organization
needs to develop which are consistent with the drivers of the organization.
II. Profile Assets – The area of profile assets include the step 2 as well as has the step 3
which has the profiles of information asset that are created. After identifying the profiles as well
as creating the profiles, the containers of the assets are then identified and the profile for each of
the asset is then captured on one single worksheet. All the information asset are shown in a
profile describing the feature that are unique, their qualities, the characteristics as well as the
values that are included in the information asset.
III. Identify Threats – The identify threat phase contains step 4 and step 5 that addresses
the threats to information asset are actually identified as then they are documented following a
structured process (Kelo, Eronen and Rousku 50). In this particular strategy, the areas that are
mainly concerned includes scenarios of real life that occurs in the organization and the threat
scenarios which also has additional threats. To identify the threats that states the threats to be
asset are mainly identified and are then documented through a series of process.
IV. Identify and Mitigate Risks – The last phase of the OCTAVE Allegro roadmap is
mainly the risk assessment phase. The risks concerned with the information assets are identified
first and then they are analyzed that is based on the threat information as well as developing
mitigation strategies that addresses the risk identified. Identifying as well as mitigating the risks
are done mostly on the basis of threat information and the mitigation strategies are them
addresses for the risk analyzed.
The output of each of the phase are explained below which are actually explained in this
section.
Step 1 – To Establish the Risk Measurement Criteria
This is the first step in the process of OCTAVE Allegro that helps to establish the drivers
of organization usually used for evaluating all effects of risks in the mission of the organization
as well as achieving the objective of the business (Wangen et al.). All the drivers include gets
reflected in criteria of measuring the risk set that is then created as well as captured as initial part
of this step. The criteria of the risk measurement are actually same as the qualitative measures
that are taken against the effect of the risk that is evaluated as well as forming a foundation that
includes information asset risk assessment. With the use of consistent criteria of risk
measurement actually helps in reflecting the organizational view ensuring the decisions about the
way to mitigate them and are consistent over many information assets as well as operating or the
departmental units.
With the evaluation of the impact of risk over a particular specific area, the organization
helps to recognize all impact of the areas that are most significant to the mission of the business
as well as business objective (Kozlovs, Cjaputa, and Marite). In some of the organization, the
impact of the relationship with customer base is more significant that impacts on the compliance
with some regulations. The prioritization is given to the impact areas that is performed in this

8RISK FRAMEWORK
step of OCTAVE Allegro framework. There is a standard worksheet template set that is provided
in the OCTAVE Allegro method for creating the criteria that has several impacts as well as
prioritize them accordingly.
Step 2 – To Develop a Profile of Information Asset
The methodology of OCTAVE Allegro mainly focuses on the information asset in the
organization and in the step 2, the process for creating the profile of the assets are actually
involved in the process. The profile is actually a representation of information asset that is used
for describing the unique features, the qualities, the characteristics as well as the value of the
profile (Amini and Norziana). The profiling of the methodology is a process that mainly ensures
that the asset is described clearly and is described consistently. The profiling states that there is
unambiguous definition of the boundary of the asset and the requirement of security for asset is
then defined adequately. Profiling each asset is then captured on a single worksheet that forms
identification threat and the risks that are included in the steps.
Step 3 – To Identify the Information Asset Containers
The containers mainly describes places that includes the information asset that are stored,
processed as well as transported. The information asset is not only included in the containers
with the boundaries of organization but the information asset often reside in the containers that
are not controlled by the organization (Hariyanti, Arif and Daniel). The risks included in the
containers include lives of information asset that are mainly inherited by them.
The problem of storing in containers becomes more important factor if the contracts of
service provider are unknown to information asset owner. For gaining the adequate profile risk
of the information asset, the organization mainly identifies all locations which contains the
information assets that are stored, processed as well as transported or the information assets that
are not in direct control of the organization.
Step 4 –To Identify the Concern Areas
In the step 4, the process of risk identification actually begins with the brainstorming
including all the possible conditions or the situations which threaten the information asset of the
organization. The scenarios that are included in the real world are mainly referred as the areas for
concerning and can represents the threats as well as corresponding all the outcomes that are
undesirable (Tøndel et al. 1-30). The areas that are concerned actually characterize the threats
that are unique in the organization and the operating conditions that are involved. The main
purpose of this step is not capturing the complete list of the possible scenario threat for the
information asset. The idea of complete list consisting of all possible threat of the situation and
conditions that come in mind are of analysis team are captured very quickly.
Step 5 – To Identify the Threat Scenarios
In the first part of step 5, the captured area of concern that are considered in the first step
are actually expanded in threat scenarios. Those scenarios are then detailed in the properties of
the threat (Wangen, Christoffer, and Einar 1-19). The collection of the threats that are developed
from the concern areas necessarily does not always provide quick consideration of the possible
threats of information asset faced by the organization. In second part of Step 5, a wide range of
the additional threats are then considered after all the threat scenarios are examined.

9RISK FRAMEWORK
Step 6 – To Identify Risks
After the identification of the threats, in the next step, all the consequences of
organization are taken in to account if the threat realized is actually captured after completing
risk picture. There can be multiple impacts of a threat involved in an organization. For instance,
disruption of the e-commerce system of the organization mostly effects the reputation of the
organization with all the customers along with the financial position. All activities that are
involved in step 6 actually ensures the different consequences of the risks that are captured.
Step 7 – To Analyze Risks
In the 7th step of risk assessment, a quantitative measure is computed to an extent that
needs the impact of threat of organization (Kawanishi et al.). The relative risk score that is
derived while considering extent which consequences the risk impact of the organization that
comes against the relative importance for the different impact areas as well as the probability
involved. Reputation is one of the important factor that an organization needs to deal with and if
the reputation of the organization have risks, it might generate high score compared to other
equivalent risk in the organization. Giving priority to the impact criteria, the organization
actually ensures that the risks are prioritized in the drivers of the organization.
Step 8 – To Select the Mitigation Approach
In the last step of the risk assessment criteria, the final step included in the process of
OCTAVE Allegro is identifying all the mitigating process of the risks that are found previously
in the organization (Wahlgren and Kowalski 129-151). There is a need of mitigation as well as
developing the mitigation strategy of the organization. The risks that are identified in the risk
framework are first prioritize on the basis of the risk score. Once risks is prioritized, all the
mitigation strategies are actually developed for considering the value asset as well as considering
its security requirements.
4. Using the OCTAVE Allegro Risk Framework
4.1 To Prepare the Octave Allegro
Some of the preparation is actually necessary before performing risk assessment
OCTAVE Allegro in an organization. The activities preparation mainly includes obtaining the
management support, allocating the appropriate all resources of organization to process as well
as scoping the activities of assessment.
4.1.1 Obtain Sponsorship of the Senior Management
Obtaining the sponsorship from the senior management of an organization is actually a
critical factor that performs the assessment of the OCTAVE allegro successfully. With
involvement of OCTAVE Allegro methods included, the management needs to be committed to
provide all the active support included in the process and they should have the will in
participating in all the processes that are necessary for developing as well as sponsoring the
criteria of risk measurement of the organization (Ilona, and Jussila). The participation level of the
management should be minimized by the methodology of OCTAVE Allegro and that is to be
leveraged all through the organization.

10RISK FRAMEWORK
The senior management should also ensure that there should be a proper resource that are
to be allocated to all processes that enables the members of assessment teams for devoting
necessary time for performing all the process. The members included in assessment team are
developing the useful results from the process as well as using of resources from the team is not
available.
4.1.2 To Allocate the Organizational Resources
There are two important aspects that are included in the methodology of OCTAVE
Allegro. The two important aspects are the composition as well as size of assessment team (Pan
and Tomlinson). For establishing the assessment team, there should be range of possibilities that
are to be involved. In most of the cases, the senior staffs mainly performed all the method by
their own depending on the knowledge they have on operational area. The group of the people
from similar operational unit mostly have some collaboration on risk assessment. In many cases
it is included as a representative from the information technology who is responsible for
participating on team or is even directly responsible for accessing them is necessary (Aries).
Access to IT department is always necessary in the process of mapping for the information assets
as well as developing the scenarios related to threat as well as plans for risk mitigation. The IT
department is actually responsible for providing the technical depth that the other team member
cannot provide.
The commitment of time for process can differ widely mainly on availability, make-up of
team, as well as experience of team, complexity of all the resource asset, environment
complexity where the assets are mainly stored, or transported or is processed and the total count
of the information asset that is being reviewed (Suroso and Bayu). For the first time the team
performs assessment on a particular information resource that often take many days. As the team
gains more experience and learns how to efficiently divide all the tasks among the team
members, they can predict the total time required for completing a particular assessment. The
team can also gain more proficiency for performing the assessments given to them reducing all
the time commitments.
4.1.3 Requirements for Training
The organizations that have other working knowledge of the existing methods of
OCTAVE framework can pick up the guidance, questionnaires as well as worksheets that are
associated with the method and then deploy them without facing any challenge or delay. The
organization can perform their work very easily without any difficulty (Wangen 52-61). The
organizations or the organizational units that includes the risk assessment is actually is a new
activity or a particular area for improving is to provide some training or has to support the
assessment of the team members. For improvement, they actually needs to provide training as
well as support the assessment related to team members. The methodology of OCTAVE Allegro
is to be dated and for that the users are to become functional in method in a half day. it can be
noted that the methodology of OCTAVE Allegro is actually designed for self-applied as well as
the personnel of assessment team who would give guidance as well as worksheets that also
includes technical report.
4.2 Performing the Assessment

11RISK FRAMEWORK
The guidance, questionnaires and the worksheets are actually necessary for performing
the assessment of OCTAVE Allegro method. These particular artefacts are actually intended for
a noting the information asset for a single time (Whitman 52-61). The organization that has
more than one information asset will actually have to repeat the process many times for each of
the information asset that are included in the scope of the risk assessment.
4.2.1 To Select the Information Assets
To keep the methodology of OCTAVE Allegro up to date, the users have to exhibit some
difficulty for identifying all the information assets that are to be include in the scope of the
assessment. But the users sometimes face challenge for selecting the subset of the assets
involved critically to the organization. This actually needs some understanding of all the assets
that supports the critical processes of the organization. If selection of the information asset is
actually left on the team judgment assessment. The importance of resource is actually based on
perceived instead of giving more that are consistent and are repeatable method for the asset
valuation (Meszaros and Alena 300-313). Usage of the factors of critical success actually
provides more consistent as well as have repeatable method that has asset based on the perceived
value instead of having more consistent as well as repeatable method for valuation asset. The
critical factors that are used actually provides consistent as well as repeatable method for
validating as well as selecting the critical assets. To perform affinity analysis pool of the
information asset are actually mapped against the success factors of the organization. This helps
in identifying information asset that are actually important for meeting mission that is fixed by
the organization.
The analysis of success factors that are included in an organization actually provides
insights for performing the risk assessment in the organizational unit. The technical report of SEI
reports that Critical success factor that are included in the risk assessment is establishing a
Foundation for the Enterprise Security Management. This provides the methodology about how
the critical success factors are identified as well as notionally cites the process that uses all the
factors for identifying the assets of organization as well as units of the organizations.
4.2.2 To Develop the Criteria of the Risk Measurement
The first step that is included in OCTAVE Allegro involves the criteria for measuring the
risk factors included in the organization (Aminzade 9-11). The users mainly considers
development of the criteria as the iterative process for improvement over the time. For all the
cases, the criteria of risk measurement actually reflects the risk tolerance of the management and
the appetite and can also be applied universally across the organization to that extent that is
possible. The main result of the risk assessment is performed for different criteria of risk
measurement that are not comparable.
4.2.3 To Repeat the Assessment
The assessment of OCTAVE Allegro is repeated all the time that has a change in
significantly in the asset of risk environment (Sardjono and Cholik). Actually, operational
environment of the organization changes constantly and due to this assessment of OCTAVE
Allegro, the snapshot is actually needed and it can be updated quickly. The OCTAVE Allegro is
includes a snapshot that helps to update quickly.